mirror of
https://github.com/ComposioHQ/composio.git
synced 2026-09-22 11:46:35 +08:00
composio-zen[bot]
4b790dc0ce
## What this fixes This is a follow-up to #3770, not a second root-cause fix. #3770 moved the docs data workflow from staging to production, centralized the production API URL, removed staging hosts from the committed data, and added the hostname guard. The committed toolkit catalog still retained staging-derived `version` values, however, because that PR intentionally did not regenerate the full catalog. After #3770 merged, the scheduled production regeneration began failing with `401 Unauthorized`: the repository's existing `COMPOSIO_API_KEY` secret is staging-scoped. The customer-visible result was that nearly every toolkit page showed the internal staging version `20260703_00`; Gmail's production version was `20260702_01`. ## Changes - Correct every `version` in `docs/public/data/toolkits.json` from the production toolkit changelog. Toolkits absent from that changelog receive `null`, matching the full generator's semantics. No other JSON field changes. - Move production changelog fetching and version application into shared `toolkit-versions.ts` logic used by the full catalog generator. - Add `bun run generate:toolkit-versions` as the narrow, reproducible generator for version-only repairs. - Reject any non-production `COMPOSIO_API_BASE` in the toolkit and meta-tool generators before a request is made. - Keep the version-distribution check as a smoke signal for the known whole-catalog staging-bump pattern, while testing the production source boundary separately. The distribution heuristic is no longer described as proof of provenance. - Fail before writing when the production changelog response is malformed or contains no versions. ## CI policy compatibility - Replace the enterprise-blocked mise action with allowlisted tool setup actions while continuing to resolve exact versions from mise.lock. Install the existing pinned mise CLI release through a checksum-verified repository script for lock freshness and preinstall validation. - Run the existing GitHub Advanced Security alert check locally and notify Slack through the already-allowlisted Slack action, avoiding the central workflow dependency rejected by the enterprise action policy. ## Verification - `bun test tests/static/` — 30 passed. - Targeted ESLint for every changed script/test — passed. - `bun run types:check` — passed. - `bun run build` — passed. - Explicit staging override of `generate-toolkits.ts` — rejected before network access. - Verified the JSON data change remains version-only; toolkit ordering, tools, triggers, descriptions, and counts are unchanged. ## Remaining deployment action An administrator still needs to replace `COMPOSIO_API_KEY` with a production-scoped key. The scheduled `docs-update-data` workflow is correctly pinned to production and therefore fails loudly with the current staging credential instead of republishing staging data. Once the secret is corrected, the normal full-catalog generator remains the authoritative refresh path. Triggered by: abhishek@composio.dev | Source: slack Session: https://zen.corp.composio.io/dashboard/#/chat/zen-3a77f73eb146 --------- Co-authored-by: Zen Agent <zen@composio.dev> Co-authored-by: abhishek <abhishek@composio.dev> Co-authored-by: jkomyno <alberto@composio.dev>
55 lines
2.1 KiB
JavaScript
55 lines
2.1 KiB
JavaScript
/**
|
|
* Single source of truth for the Composio production API URL used by the docs
|
|
* generators (fetch-openapi.mjs, generate-toolkits.ts, generate-meta-tools.ts).
|
|
*
|
|
* Published docs data must come from production. The "Docs - Update Data"
|
|
* workflow leaves the base URL unset, and the toolkit/meta-tool generators
|
|
* reject non-production overrides before making a request. Host rewriting is
|
|
* retained as defense in depth for staging URLs embedded inside an otherwise
|
|
* production-sourced payload.
|
|
*
|
|
* The guard test deliberately does NOT import from this module: an oracle must
|
|
* verify against an independently-stated expectation, so a wrong edit here fails
|
|
* the test instead of silently moving both sides together.
|
|
*/
|
|
|
|
export const PRODUCTION_HOST = 'backend.composio.dev';
|
|
export const PRODUCTION_BASE_URL = `https://${PRODUCTION_HOST}`;
|
|
export const PRODUCTION_API_V3_URL = `${PRODUCTION_BASE_URL}/api/v3`;
|
|
export const PRODUCTION_API_V31_URL = `${PRODUCTION_BASE_URL}/api/v3.1`;
|
|
|
|
/**
|
|
* Resolve the API base used to generate publishable docs data.
|
|
*
|
|
* An override is accepted only when it normalizes to the production v3 URL.
|
|
* Failing loudly prevents a local or CI environment variable from silently
|
|
* turning the checked-in catalog into a staging snapshot.
|
|
*/
|
|
export function requireProductionApiV3Url(configuredUrl) {
|
|
const normalized = configuredUrl?.trim().replace(/\/+$/, '') || PRODUCTION_API_V3_URL;
|
|
|
|
if (normalized !== PRODUCTION_API_V3_URL) {
|
|
throw new Error(
|
|
`Published docs data must be generated from ${PRODUCTION_API_V3_URL}; received ${normalized}`
|
|
);
|
|
}
|
|
|
|
return PRODUCTION_API_V3_URL;
|
|
}
|
|
|
|
/** Non-production hosts that must never appear in published docs data. */
|
|
export const STAGING_HOSTS = ['staging-backend.composio.dev', 'staging-apollo.composio.dev'];
|
|
|
|
/**
|
|
* Rewrite any staging host embedded in a serialized JSON string to the
|
|
* production host.
|
|
* Operates on the serialized string to avoid disturbing typed data pipelines.
|
|
*/
|
|
export function stripStagingHosts(text) {
|
|
let out = text;
|
|
for (const host of STAGING_HOSTS) {
|
|
out = out.split(host).join(PRODUCTION_HOST);
|
|
}
|
|
return out;
|
|
}
|